CVE-2019-25739

EIP tracks 1 public exploit for CVE-2019-25739. PoCs published by m0ze.

AI-analyzed exploit summary The exploit demonstrates a persistent XSS vulnerability in GigToDo Freelance Marketplace Script v1.3. It requires user interaction to inject malicious JavaScript payloads into the 'Proposal's Description' field, which executes when viewed by other users.

GigToDo 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript and HTML code through the proposal description field. Attackers can craft XSS payloads in the create_proposal endpoint that execute when administrators or other users view the stored proposal, enabling cookie theft and malicious redirects.